prodlint

io.github.prodlintPublished by GitHub account prodlintv0.10.6Updated Nov 8, 2026

Production readiness for vibe-coded apps. 52 checks for security, reliability, and performance.

VerifiedSTDIODesktop onlyWeb Search & ScrapingDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Runs prodlint's static production-readiness scan on a local JS/TS project or a deployed site, returning 0-100 scores and prioritized findings.

What you can do
  • Scan a local JS/TS project for production readiness, returning an overall and per-category score plus findings ordered by severity
  • Narrow or widen results by minimum severity, category and finding count, with all critical findings always included
  • Check a deployed website's AI agent-readiness across 14 checks such as robots.txt AI directives, llms.txt, AgentCard and WebMCP
  • Receive each result as a Markdown summary plus structured output
When to use it
Useful when reviewing AI-generated or vibe-coded Next.js/JS/TS apps before shipping, or when auditing a live site for AI agent-readiness signals. Both tools are read-only, so it fits quick checks inside an editor or agent workflow.
Requirements
Runs as a local stdio process via npx from the prodlint-mcp npm package, so Node.js and network access for the package download are needed. No accounts, API keys, environment variables or headers are declared.
Before you install
The scan tool reads project files from the path you give it, so point it only at directories you intend to expose to the assistant. The scan-web tool fetches the URL you provide, which leaves the machine. Findings are advisory and may include false positives despite the documented heuristics.

Installation

In SourceWeft

  1. Open prodlint in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

prodlint

[npm version] [npm downloads] [License: MIT]

Production readiness for vibe-coded apps.

Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues that Cursor, v0, Bolt, and Copilot create — hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules.

bash
npx prodlint
  prodlint v0.10.6  Scanned 148 files · 2 critical · 5 warnings · 1 info
  src/app/api/checkout/route.ts    12:1  INFO  No rate limiting — anyone could spam this endpoint and run up your API costs  rate-limiting    28:5  WARN  Empty catch block silently swallows error  shallow-catch
  src/actions/submit.ts    5:3   CRIT  Server action uses formData without validation  next-server-action-validation      ↳ Validate with Zod: const data = schema.safeParse(Object.fromEntries(formData))
  src/lib/db.ts    1:1   CRIT  Package "drizzle-orm" is imported but not in package.json  hallucinated-imports
  Scores  security        72 ████████████████░░░░  (8 issues)  reliability     85 █████████████████░░░  (4 issues)  performance     95 ███████████████████░  (1 issue)  ai-quality      90 ██████████████████░░  (3 issues)
  Overall: 82/100 (weighted)
  2 critical · 5 warnings · 4 info

Why?

Vibe coding is the fastest way to build. Shipping fast means knowing your code is production-ready — not just that it compiles. Hardcoded secrets, hallucinated packages, missing auth, and XSS vectors pass type-checks and look correct — but they aren't ready for production.

prodlint checks what TypeScript and ESLint don't: whether your vibe-coded app is ready for production.

Install

bash
npx prodlint                              # Run directly (no install)npx prodlint ./my-app                     # Scan specific pathnpx prodlint --json                       # JSON output for CInpx prodlint --sarif                      # SARIF 2.1.0 for GitHub Code Scanningnpx prodlint --summary                    # Quick pass/fail + top 3 blockersnpx prodlint --profile startup            # Only critical findingsnpx prodlint --profile strict             # All findings including infonpx prodlint --baseline .prodlint-baseline.json   # Only new findingsnpx prodlint --ignore "*.test.ts"         # Ignore patternsnpx prodlint --min-severity warning       # Only warnings and criticalsnpx prodlint --quiet                      # Suppress badge output

Or install it:

bash
npm i -D prodlint     # Project dependencynpm i -g prodlint     # Global install

52 Rules across 4 Categories

Security (27 rules)

RuleWhat it checks
secretsAPI keys, tokens, passwords hardcoded in source
auth-checksAPI routes with no authentication
env-exposureNEXT_PUBLIC_ on server-only secrets
input-validationRequest body used without validation
cors-configAccess-Control-Allow-Origin: *, wildcard + credentials escalated to critical
unsafe-htmldangerouslySetInnerHTML with user data
sql-injectionString-interpolated SQL queries (ORM-aware)
open-redirectUser input passed to redirect()
rate-limitingAPI routes with no rate limiter
phantom-dependencyPackages in node_modules but missing from package.json
insecure-cookieSession cookies missing httpOnly/secure/sameSite
leaked-env-in-logsprocess.env.* inside console.log calls
insecure-randomMath.random() used for tokens, secrets, or session IDs
next-server-action-validationServer actions using formData without Zod/schema validation
env-fallback-secretSecurity-sensitive env vars with hardcoded fallback values
verbose-error-responseError stack traces or messages leaked in API responses
missing-webhook-verificationWebhook routes without signature verification
server-action-authServer actions with mutations but no auth check
eval-injectioneval(), new Function(), dynamic code execution
next-public-sensitiveNEXT_PUBLIC_ prefix on secret env vars
ssrf-riskUser-controlled URLs passed to fetch in server code
path-traversalFile system operations with unsanitized user input
unsafe-file-uploadFile upload handlers without type or size validation
supabase-missing-rlsCREATE TABLE in migrations without enabling RLS
deprecated-oauth-flowOAuth Implicit Grant (response_type=token)
jwt-no-expiryJWT tokens signed without an expiration
client-side-auth-onlyPassword comparisons or auth logic in client components

Reliability (11 rules)

RuleWhat it checks
hallucinated-importsImports of packages not in package.json
error-handlingAsync operations without try/catch
unhandled-promiseFloating promises with no await or .catch
shallow-catchEmpty catch blocks that swallow errors
missing-loading-stateClient components that fetch without a loading state
missing-error-boundaryRoute layouts without a matching error.tsx
missing-transactionMultiple Prisma writes without $transaction
redirect-in-try-catchredirect() inside try/catch — Next.js redirect throws, catch swallows it
missing-revalidationServer actions with DB mutations but no revalidatePath
missing-useeffect-cleanupuseEffect with subscriptions/timers but no cleanup return
hydration-mismatchwindow/Date.now()/Math.random() in server component render path

Performance (6 rules)

RuleWhat it checks
no-sync-fsreadFileSync in API routes
no-n-plus-oneDatabase calls inside loops
no-unbounded-query.findMany() / .select('*') with no limit
no-dynamic-import-loopimport() inside loops
server-component-fetch-selfServer components fetching their own API routes
missing-abort-controllerFetch/axios calls without timeout or AbortController

AI Quality (8 rules)

RuleWhat it checks
ai-smellsany types, console.log, TODO comments piling up
placeholder-contentLorem ipsum, example emails, "your-api-key-here" left in production code
hallucinated-api.flatten(), .contains(), .substr() — methods AI invents
stale-fallbacklocalhost:3000 hardcoded in production code
comprehension-debtFunctions over 80 lines, deep nesting, too many parameters
codebase-consistencyMixed naming conventions across the project
dead-exportsExported functions that nothing imports
use-client-overuse"use client" on files that don't use any client-side APIs

Smart Detection

prodlint avoids common false positives:

  • AST parsing — Babel-based analysis for 14 rules (imports, catch blocks, redirects, redirects in try/catch, SSRF, path traversal, JWT, HTML injection, hydration, transactions, env leaks, loops, SQL, route handlers) with regex fallback
  • Monorepo support — npm/yarn/pnpm workspace dependencies resolved automatically
  • Framework awareness — Prisma, Drizzle, Supabase, Knex, and Sequelize whitelists prevent false SQL injection flags
  • Middleware detection — Clerk, NextAuth, Supabase middleware (middleware.ts, or proxy.ts on Next.js 16) detected — auth findings downgraded
  • Block comment awareness — patterns inside /* */ are ignored
  • Path alias support — @/, ~/, and tsconfig paths aren't flagged as hallucinated imports
  • Route exemptions — auth, webhook, health, and cron routes are exempt from auth/rate-limit checks
  • Test/script file awareness — lower severity for non-production files
  • Fix suggestions — findings include actionable fix hints with remediation code

Scoring

Each category starts at 100. Deductions per finding:

SeverityDeductionPer-rule cap
critical-8max 1
warning-2max 2
info-0.5max 3

Diminishing returns: after 30 points deducted in a category, further deductions are halved; after 50, quartered.

Weighted overall: security 40%, reliability 30%, performance 15%, ai-quality 15%. Floor at 0. Exit code 1 if any critical findings exist.

GitHub Action

Add to .github/workflows/prodlint.yml:

yaml
name: Prodlinton: [pull_request]
jobs:  scan:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: prodlint/prodlint@v1        with:          threshold: 50

Posts a score breakdown as a PR comment, and fails the build when the scan finds critical issues or the score is below threshold. Each release of the action runs its matching prodlint version, so pinning the action (@v1, a version tag, or a commit SHA) also pins the scanner.

InputDefaultDescription
path.Path to scan
threshold0Minimum score to pass (0-100)
fail-on-criticaltrueFail when the scan finds critical issues; false reports them without failing
ignoreComma-separated glob patterns to ignore
commenttruePost PR comment with results
OutputDescription
scoreOverall score (0-100)
criticalNumber of critical findings

SARIF + GitHub Code Scanning

Upload prodlint results to GitHub's Security tab:

yaml
- name: Run prodlint  run: npx prodlint --sarif > prodlint.sarif
- name: Upload SARIF  uses: github/codeql-action/upload-sarif@v4  with:    sarif_file: prodlint.sarif    category: prodlint

Baseline for Existing Projects

Adopt prodlint gradually without drowning in pre-existing findings:

bash
# Save current state as baselinenpx prodlint --baseline-save .prodlint-baseline.json
# CI only fails on NEW findingsnpx prodlint --baseline .prodlint-baseline.json

MCP Server

Use prodlint inside Cursor, Claude Code, or any MCP-compatible editor:

Claude Code:

bash
claude mcp add prodlint -- npx -y prodlint-mcp

Cursor / Windsurf:

json
{  "mcpServers": {    "prodlint": {      "command": "npx",      "args": ["-y", "prodlint-mcp"]    }  }}

prodlint-mcp is a thin launcher for the server built into prodlint. It's published with every prodlint release, so it always runs the matching scanner.

Ask your AI: "Run prodlint on this project" and it calls the scan tool directly.

ToolInputsReturns
scanpath (project directory), optional ignore, minSeverity (critical / warning / info), categories, maxFindings (default 30)Score, category scores, and findings most severe first. Every critical finding is listed, even past maxFindings.
scan-weburlSite score, grade, and the 14 agent-readiness checks

Both tools return a Markdown summary plus structured output (structuredContent matching each tool's outputSchema), and both are marked read-only (readOnlyHint), which hosted reviewers such as GitHub Copilot code review require before they call an MCP tool.

Site Score

Check any deployed website for AI agent-readiness — 14 checks covering emerging standards like llms.txt, TDMRep, AgentCard, AI-Disclosure, HTTP Signatures (RFC 9421), and more.

bash
npx prodlint --web example.comnpx prodlint --web example.com --json     # JSON output
  prodlint site score  example.com · 14 checks
  Score: 42 C  ████████░░░░░░░░░░░░
  ✗ AI-Disclosure Header          0/10  No AI-Disclosure header found.  ✗ Content-Usage Directives      0/10  No Content-Usage directives found.  ✗ TDMRep                        0/10  No TDMRep found.  ✗ A2A AgentCard                  0/5  No agent-card.json found.  ✗ ai.txt                         0/5  No ai.txt found at site root.  ! llms.txt                       2/5  llms.txt found but missing key sections.  ✓ robots.txt                   10/10  robots.txt found with 15 rules.  ✓ Sitemap                      10/10  Valid sitemap with 42 URLs.  ✓ Structured Data              10/10  Found JSON-LD structured data.  ✓ OpenGraph                    10/10  Complete OpenGraph tags found.  ✓ Page Speed                    5/5   Loaded in 0.8s.  ✓ AI Bot Directives             5/5   AI-specific bot rules found.  ✓ WebMCP Tools                   0/5  No WebMCP tools detected.
  7 passed · 5 failed · 1 warnings
  Full results: https://prodlint.com/score?url=example.com

Or check your score interactively at prodlint.com/score.

For AI Tools

prodlint is designed specifically for AI-generated code patterns. Every rule checks for production issues that AI coding tools consistently create — not style nits.

Suppression

Suppress a single line:

ts
// prodlint-disable-next-line secretsconst key = "sk_test_example_for_docs"

Suppress an entire file (place at top):

ts
// prodlint-disable secrets

Programmatic API

ts
import { scan } from 'prodlint'
const result = await scan({ path: './my-project' })console.log(result.overallScore) // 0-100console.log(result.findings)     // Finding[]

Badge

md
[![prodlint](https://img.shields.io/badge/prodlint-85%2F100-brightgreen)](https://prodlint.com)

License

MIT

Source: README.md at commit 5cef619

Tools

2

scan

Scan a project for production readiness

Check a vibe-coded JS/TS project's production readiness. Returns a 0-100 score and findings across security, reliability, performance, and AI quality, most severe first. Every critical finding is always included; use minSeverity, categories, and maxFindings to narrow or widen the rest.

ParameterspathrequiredignorecategoriesmaxFindingsminSeverity

scan-web

Score a website's AI-agent readiness

Check a deployed website's AI agent-readiness. Returns a 0-100 score across 14 checks including robots.txt AI directives, llms.txt, AgentCard, WebMCP, and more.

Parametersurlrequired

Version history

6
  1. v0.10.6LatestNov 1, 2026
  2. v0.10.5Nov 1, 2026
  3. v0.10.4Oct 29, 2026
  4. v0.10.3Oct 26, 2026
  5. v0.10.2Oct 26, 2026
  6. v0.10.0Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts